Presented at the Atlanta Web Performance Meetup Group on June 2014, Billy Hoffman from Zoompf shows how to improve the performance of your website using SPDY and SSL and discusses SSL issues such as Heartbleed and CRIME
2. What Is SPDY?
• “Speedy”
• Next Gen Web Protocol
– Created by Google in 2009
– Basis of HTTP/2 spec
• Designed for speed
• Familiar Request/Response model
– Largely abstracted away
– Much improved plumbing
– Extra features
12. Additional Features
• Server Push!
• Header Compression
• Body Compression
• Better use of TCP connections
• Better upgrade approach
13. Today’s Focus
• Setting the Stage for SPDY
– Can speak SSL with a server
– Can create a valid SSL connection
– Client and Server agree to use SPDY
• Optimizing SPDY
– Optimizing SSL
– Optimizing SPDY
– Avoiding optimizations that hurt SPDY
• Tools to help
15. SSL Connectivity
• Hostname resolves
• IP is reachable
• Web server is listening on SSL port
• Web server understands SSL
• Web server knows which site you want
– Shared Hosting and SNI
21. X.509 Cert: Is it Trusted?
• Do I trust the issuer?
– If not, was it signed by someone I trust?
• Has it been revoked?
– CRL lists
– Online Certificate Status Protocol (OCSP)
22. Agreeing to Use SPDY
• Client tells server it supports SPDY
• Server tells client it supports SPDY
• Client sends SPDY over SSL
• Else, falls back to HTTP over SSL
24. Announcing SPDY support in the
SSL Handshake
Microsoft Technet: Host
TLS/SSL Works
http://bit.ly/16Zx0en
+
Ext:13172/A
LPN
+ NPN/ALPN
+
Ext:13172/ALPN
29. The SSL Tarpits
• SSL handshake requires 2 round trips
• Certificates can be large
• Certificates need to be validated
• Keys can be too large
• Algorithms can be slow
• Revocation
30. The SSL Handshake is Costly!
Microsoft Technet: Host
TLS/SSL Works
http://bit.ly/16Zx0en
32. • Both sides keep state/cache
• Reuse based on id
• Widely supported
Microsoft Technet: Host
TLS/SSL Works
http://bit.ly/16Zx0en
sessionid: 3a8a…
Big cache of
all ids given
out, and
associated
keys/ciphers
Session Identifiers
33. • Client stores “Magic Ticket”
• RFC 5077, optional
• No IIS support
Microsoft Technet: Host
TLS/SSL Works
http://bit.ly/16Zx0en
Encrypted summary of
keys/ciphers, signed by
server
Verifies
summary is
valid, uses
values
Session Tickets
35. False Start: Not Gone
• “The Failure of False Start”
• Chrome still does it!
– Desktop and mobile
• Any server that supports NPN! (with
forward secure)
– Any server with SPDY support…
– Or SSL + NPN, but only announces HTTP/1.1!
41. Cipher Order/Choice Matters
• RC4 is the best
• Unless on a
machine with AES-
NI
– Intel i7, Xeons,
some AMD
– Not most virtual
machines!!!
• First match wins
http://zombe.es/post/4078724716
46. SPDY Optimization
• SPDY only works over SSL
• Ensure that all your traffic if over SSL
• HTTP 301 direct for http: to https:
– Add a cache-control header!
• HTTP Strict Transport Security (HSTS)
– Like the browser’s cache, but for protocol
access. Make (semi) far future
– Wide support (>90% of SPDY capable
browsers)
47. Avoid These Optimizations
• Domain Sharding
– Hack to request multiplexing, not needed
– Hurts SPDY by spreading requests out
• JavaScript CDNs
– These are a horrible blight on the web!
– http://statichtml.com/2011/google-ajax-
libraries-caching.html
– https://github.com/h5bp/html5-
boilerplate/pull/1327
52. SSL/SPDY Optimization Check List
• Website responds over SSL/443
• Website has NPN extension (even without
SPDY for False Start)
• X.509 certificate is valid
• X.509 chain is short
• SSL Asymmetric keys are <= 2048
• Cipher is fast! (RC-4, AES-128 if supports
dedicated instructions)
53. SSL/SPDY Optimization Check List
• SSL session resumption is enabled (both
identifiers and tickets)
• No SSL compression
• Website is using latest version of SPDY
• HTTP permanently (301) redirects to
HTTPS (including cache header)
• HTTPS sends HTTP Strict Transport
Security header
54. Great Resources
• Ivan Ristic (blog.ivanristic.com)
• Adam Langley (www.imperialviolet.org)
• Mark Nottingham (www.mnot.net/blog/)
• Qualys SSL Labs (ssllabs.com)
• SPDYCheck (spdycheck.org)